Sashiko reported two potential issues about interpreter fallback [1] [2]. After verifying them by patch #7 of v1, I think they are real issues. With LLM assistance, the interpreter does not support the internal BPF_PROBE_ATOMIC insn and the gotox insn (used for indirect jumps), either.
1) the user BPF_ADDR_SPACE_CAST insn the interpreter just ignores it. 2) the arena ST/STX/LDX insn the interpreter could hit the BUG_ON() in ___bpf_prog_run(). 3) the BPF_MOV64_PERCPU_REG insn the interpreter could hit page fault, due to loading memory from invalid __percpu pointer. 4) the internal BPF_PROBE_ATOMIC insn the interpreter could hit the BUG_ON() in ___bpf_prog_run(). 5) the gotox insn used for indirect jumps the interpreter could hit the BUG_ON() in ___bpf_prog_run(), too. Reject these insns on interpreter fallback path in __bpf_prog_select_runtime() by setting 'jit_required = true'. Link: [1] https://lore.kernel.org/bpf/[email protected]/ [2] https://lore.kernel.org/bpf/[email protected]/ Changes: v1 -> v2: * Drop RFC. * Change target tree to bpf-next to utilize the 'jit_required' bit. * Set jit_required as true if there's arena map, then all arena-related insns will be rejected if JIT is not available. * Set jit_required as true if there's insn_array map, then the gotox insns will be rejected if JIT is not available. * Drop the issues-proven patch. * v1: https://lore.kernel.org/bpf/[email protected]/ Leon Hwang (3): bpf: Disallow interpreter fallback for arena-related insns bpf: Disallow interpreter fallback for gotox insn bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn include/linux/bpf.h | 4 ++-- kernel/bpf/fixups.c | 5 +++++ kernel/bpf/verifier.c | 2 ++ 3 files changed, 9 insertions(+), 2 deletions(-) -- 2.55.0
